Author: HackWatchit

Hanko is an open-source, API-first authentication solution purpose-built for the passwordless era. “We focus on helping developers and organizations modernize their authentication flows by migrating users towards passkeys, while still supporting all common authentication methods like email/password, MFA, OAuth, as well as SAML SSO,” Felix Magedanz, CEO at Hanko, told Help Net Security. “What truly sets us apart is our commitment to developer experience,” explained Magedanz. Hanko is fully open source and licensed under AGPL v3, with a commercially supported cloud offering for those who want to avoid open-source copyleft obligations or hosting and managing the Hanko backend themselves. The…

Joff Thyer // Black Hills Information Security loves performing both internal penetration tests, as well as command and control testing for our customers. Thanks to the efforts of many great researchers in the industry, we are lucky enough to escalate privileges in many environments, laterally move, and demonstrate access to sensitive data. As a penetration tester, we must always have the mindset of demonstrating business risk as the number one goal. Thus I find myself often saying things like “Domain Admin” in the Windows Active Directory world are not everything. In fact, in support of this idea, there have been…

Companies running Samsung MagicINFO, a platform for managing content on Samsung commercial digital displays, should upgrade to the latest available version of its v9 branch to fix a vulnerability that’s reportedly being exploited by attackers. If this advice sounds familiar, it’s because it is a repeat of a call that happened ten days ago, when researchers spotted attackers attempting to compromise machines running the platform’s server component by exploiting a path traversal vulnerability. At the time, the researchers believed that the vulnerability in question was CVE-2024-7399 (ostensibly fixed in August 2024), since a proof-of-concept exploit for such a vulnerability was…

On Thursday, CISA warned U.S. federal agencies to secure their systems against ongoing attacks exploiting a high-severity vulnerability in the Chrome web browser. Solidlab security researcher Vsevolod Kokorin discovered the flaw (CVE-2025-4664) and shared technical details online on May 5th. Google released security updates to patch it on Wednesday. As Kokorin explained, the vulnerability is due to insufficient policy enforcement in Google Chrome’s Loader component, and successful exploitation can allow remote attackers to leak cross-origin data via maliciously crafted HTML pages. “You probably know that unlike other browsers, Chrome resolves the Link header on subresource requests. But what’s the problem? The issue is…

How are you, hacker? 🪐 What’s happening in tech today, May 12, 2025? The HackerNoon Newsletter brings the HackerNoon homepage straight to your inbox. On this day, we present you with these top quality stories. From Crowdsales in Crypto: Initial (Something) Offerings and Their Regulations to Good Programmers Always Be Refactoring, let’s dive right in. By @phenomenology [ 10 Min read ] Human brain evolution guides AI consciousness research; neuroscience-inspired caution and precise definitions are essential for artificial minds. Read More. By @blockchainize [ 4 Min read ] Blockchain systems combine distributed, social, and economic dynamics. Learn how simulation frameworks…

Author/Presenter: Glenn Thorpe Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel. Permalink The post BSidesLV24 – GroundFloor – Discover The Hidden Vulnerability Intelligence Within CISA’s KEV Catalog appeared first on Security Boulevard.

ESET reports on RoundPress, a cyber espionage campaign by Russia’s Fancy Bear (Sednit) targeting Ukraine-related organizations via webmail vulnerabilities and SpyPress malware. Cybersecurity researchers at ESET have revealed a sophisticated cyber espionage campaign, codenamed RoundPress, assessing with “medium confidence” that it is orchestrated by the Russian-backed Sednit group (aka APT28, Fancy Bear). This operation is actively targeting organizations linked with the ongoing conflict in Ukraine, aiming to exfiltrate confidential data from vulnerable webmail servers like RoundCube. The Sednit group, linked by the US Department of Justice to the 2016 Democratic National Committee (DNC) hack and tracked by Hackread.com in attacks…

BB King // BB King looks at testing modern web apps in that “enterprise environment” so many of us inhabit. Taking the perspective of the Lonely Application Security Person in an organization that may not shower you with cash and resources, we look at some free tools, some relatively cheap tools that do awesome things, and some ways you can quietly practice your web app testing skills. Slides can be found here: https://www.dropbox.com/s/8y1eho8qkdomi6n/Webapp%20Pentesting%20for%20Non-Majors.pptx?dl=0 We think BB is pretty cool …but we might be biased. Why not find out for yourself and take a class with him? Modern WebApp Pentesting Available…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 45  |  Security Affairs newsletter Round 524 by Pierluigi Paganini – INTERNATIONAL EDITION  |  Experts found rogue devices, including hidden cellular radios, in Chinese-made power inverters used worldwide  |  US Government officials targeted with texts and AI-generated deepfake voice messages impersonating senior U.S. officials  |  Shields up US retailers. Scattered Spider threat actors can target them  |  U.S. CISA adds Google Chromium, DrayTek routers, and SAP NetWeaver flaws to its Known Exploited Vulnerabilities catalog  |  Pwn2Own Berlin 2025 Day Two: researcher earned 150K hacking VMware ESXi  |  New botnet HTTPBot targets gaming and tech industries…